China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor

Summary: Gen Digital reported that a China-linked group, UNC3569, exploited a flaw in Sogou Input Method's sgbiz: link handler to pass unfiltered command-line arguments to SGMyInput.exe, which opened the skin store in Sogou's bundled Chromium 80 browser with its sandbox and same-origin policy disabled, then served an exploit for CVE-2021-38003 to install the GRAYRABBIT backdoor. Tencent fixed the flaw in version 16.3.0.3498, pushed by automatic update on April 21, 2026, tracked as CVE-2026-51990, but the browser engine and its disabled protections were left unchanged.
What you should know: Citizen Lab's 2023 research put Sogou Input Method at more than 455 million monthly users, and at least 32 of the 41 Chromium V8 flaws in CISA's catalog were fixed in Chrome releases after the version Sogou still ships - so the patch closes the link handler while leaving the browser engine that made the chain work in place.

Read the original at The Hacker News ↗

Topics: Detection & Response
Related: YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026
Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026
Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026